Endpoint and Network Data in SIEM SCE Practice Questions (Page 3)

Questions 11–15

1. 11expert · hard

   A SOC analyst is investigating a possible command-and-control (C2) communication. The SIEM shows a workstation making periodic HTTPS connections to an external IP that is not on any blocklist. The endpoint logs show a suspicious process running. Which data source would provide the most definitive evidence of C2 communication?

   • AFull packet capture of the HTTPS traffic, decrypted with the organization's SSL inspection proxy.
   • BFirewall logs showing the connections are allowed.
   • CDNS logs showing the domain resolved to the IP.
   • DNetFlow records showing the periodic connections.
   Reveal Solution Discussion Select an answer first
2. 12expert · hard

   A SIEM engineer is configuring ingestion for a new network security appliance that generates logs in a vendor-specific format. The SIEM's default parser fails to extract the source IP and destination IP correctly. Which approach is the most reliable to ensure accurate parsing?

   • AWrite a custom parser based on the vendor's log format documentation and test it against a sample of real logs.
   • BStore the logs as raw text and use regex in every search query.
   • CUse the SIEM's automatic field extraction feature and trust its results.
   • DAsk the vendor to change the log format to a standard format like CEF.
   Reveal Solution Discussion Select an answer first
4. 13application · medium

   A SIEM engineer is integrating a new network tap that provides full packet capture. The SIEM already ingests NetFlow and firewall logs. Which data source should the engineer prioritize for detecting the content of an attack payload?

   • ADNS logs, because they show the domain queried.
   • BFirewall logs, because they show the allow/deny decision.
   • CNetFlow records, because they summarize the traffic.
   • DFull packet capture, because it contains the actual payload data.
   Reveal Solution Discussion Select an answer first
5. 14expert · hard

   An alert fires when a workstation makes an outbound connection to a known command-and-control IP. The SIEM shows the firewall allowed the traffic, but endpoint logs show no matching process creation event for the connection. Which conclusion is most defensible?

   • AThe alert is a false positive because the endpoint did not generate a process event
   • BThe endpoint logging is incomplete or the process was already running before logging started
   • CThe firewall log is inaccurate and the connection never occurred
   • DThe connection was generated by a kernel-mode driver, which never appears in process logs
   Reveal Solution Discussion Select an answer first
6. 15application · medium

   A SOC team wants to detect when a user disables security software on their workstation. Which endpoint data source would provide the most direct evidence?

   • AWindows Event Logs for service control manager (Event ID 7045) or security software-specific logs showing the service was stopped.
   • BNetwork connection logs showing the workstation's outbound traffic.
   • CProcess creation logs showing the user's applications.
   • DFile integrity monitoring logs showing changes to the security software's files.
   Reveal Solution Discussion Select an answer first